What a reverse proxy does
A reverse proxy is a server that accepts requests on behalf of other servers. A visitor talks to the proxy. The proxy forwards the request to the right app and sends the answer back. The visitor never sees the app.
Why one front door helps
My VPS runs more than a dozen apps. Without a proxy, each app would need its own public port, its own certificate, and its own login handling. With a proxy, only the proxy faces the internet.
The proxy does four jobs for every app:
- It picks the app. The
Hostheader in the request names the site, such asstatus.example.com, and the proxy routes on that name. - It ends TLS. The proxy holds the certificate, so the apps speak plain HTTP on a private network.
- It compresses responses. The password manager’s web vault loads a 7 MB
file, and
encode zstd gzipmade it load on mobile data. - It checks who may come in. A single line,
import sso, asks the login server before any request reaches an app.
Why I use Caddy
Caddy gets and renews Let’s Encrypt certificates on its own. A new site is a
hostname and a reverse_proxy line:
rss.example.com {
reverse_proxy freshrss:80
}That is the whole config for a working HTTPS site. Caddy also serves HTTP/3, which is why the firewall on my VPS opens UDP 443 next to TCP 443.
The app name freshrss works because every container joins one Docker
network, and Docker resolves container names inside it. Nothing but Caddy
publishes a web port.
What a proxy does not do
A proxy does not make an app safe. If an app has a bug, the proxy forwards the attack. The proxy only limits what the internet can reach, and it gives you one place to add a login, a rate limit, or a block.
It also adds one more thing that can break. The first note I wrote about this setup, Caddy reload is not enough, is about exactly that: the proxy ran the old config and told me it was fine.
Where to go next
- One VPS, one login adds a login page in front of the proxy.
- Build the one-VPS stack from zero shows the whole setup in steps.